- Information security professionals
tackle a wide variety of risks in their roles.
These vary from earthquakes and tornadoes
to hackers and viruses.
The sheer quantity of forces aligned against you
may sometimes be a little overwhelming.
Fortunately, we have risk assessment tools
at our disposal that can help us prioritize our response.
First we need a common language.
In everyday life people often use the terms
threat, vulnerability, and risk interchangeably.
They are actually three different concepts.
A threat is some external force
that jeopardizes the security
of your information and systems.
Threats might be naturally occurring
such as hurricanes and wildfires,
or manmade such as hacking and terrorism.
You can't normally control
what threats are out there.
They exist independently.
Vulnerabilities are weaknesses in your security controls
that a threat might exploit
to undermine the confidentiality, integrity,
or availability of your information or systems.
These might include missing patches,
promiscuous firewall rules,
or other security misconfigurations.
You do have control over the vulnerabilities
in your environment, and security professionals
spend much of their time hunting down
and remediating vulnerabilities.
Risks occur when your environment
contains both a vulnerability
and a corresponding threat
that might exploit that vulnerability.
For example, if you haven't updated
your antivirus signatures recently
and hackers release a new virus on the internet,
you face a risk.
You are vulnerable because
you're missing a security control
and there's a threat, the new virus.
There is no risk if either the threat
or vulnerability factor is missing.
For example, if you live in an area
far from the coast, it doesn't matter
if your building is vulnerable to hurricanes
because there is no threat of a hurricane in your region.
Similarly, if you store your backup tapes
in a fireproof box, there is no risk
from a building fire because your storage container
is not vulnerable to fire.
Once you've identified the risks facing your organization,
you probably still have a somewhat overwhelming list.
The next stage in the process ranks those risks
by two factors: likelihood and impact.
The likelihood of a risk is the probability
that it will actually occur.
For example, there is a risk of earthquake
in both California and Wisconsin.
When you look at the data, however,
you find that the probability of an earthquake occurring
is far higher in California
where almost 5,000 significant earthquakes occurred
over a 25-year period.
During that same time, Wisconsin didn't experience
a single major earthquake.
Therefore, security professionals in California
must be hypervigilant about the risk of earthquakes
while those in Wisconsin can probably ignore it.
The impact of a risk is the amount of damage
that will occur if the risk materializes.
For example, an earthquake might cause
devastating damage to a data center
while a rainstorm might not cause
any damage at all.
Security professionals use likelihood
and impact information to help prioritize
the many risks facing their organization each day.
Those with higher likelihood and impact ratings
require the most attention.